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All claims being allowable, PROSECUTION ON THE MERITS IS (OR REMAINS) CLOSED in this application. If not included 
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NOTICE OF ALLOWABILITY IS NOT A GRANT OF PATENT RIGHTS. This application is subject to withdrawal from issue at the initiative 
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1. This communication is responsive to 8/3/05 . 

2. [El The allowed claim(s) is/are 1-2.4.10.14-26,28.34,38-53 . 

3. □ Acknowledgment is made of a claim for foreign priority under 35 U.S.C. § 1 19(a)-(d) or (f). 
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1 • □ Certified copies of the priority documents have been received. 

2. □ Certified copies of the priority documents have been received in Application No. . 

3. □ Copies of the certified copies of the priority documents have been received in this national stage application from the 

International Bureau (PCT Rule 17.2(a)). 
* Certified copies not received: . 

Applicant has THREE MONTHS FROM THE "MAILING DATE" of this communication to file a reply complying with the requirements 
noted below. Failure to timely comply will result in ABANDONMENT of this application. 
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Paper No./Mail Date . 
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Examiner's Amendment 
Authorization for this examiner's amendment was given in a telephone interview with 
Kevin Zilka on 9/8/05. The examiner's amendment is made to claims 24,50, and 52 to satisfy a 
101 issue. 

5 . An examiner's amendment to the record appears below. Should the changes and/or 

additions be unacceptable to applicant, an amendment may be filed as provided by 37 CFR 
1.312. To ensure consideration of such an amendment, it MUST be submitted no later than the 
payment of the issue fee. 

10 In line 1 of the preamble of claims 24 and 52, the phrase stored on a computer- 

readable medium," should be inserted between "product" and "for". 

In the line 1 of the preamble of claim 50, the phrase including logic stored on a 
computer-readable medium," should be inserted between "system" and "for". Also, in line 2 of the 
15 preamble, the phrase "the logic" should be inserted before "comprising". 



Allowable Subject Matter 

All claims have been deemed allowable over the prior art. More specifically, the 
independent claims (1,24, and 50-52) which incorporate substantially the same matter have at 

20 least two limitations which the examiner finds patentable over the prior art. First, the limitation 

"wherein the opened share mode indicates a plurality of parameters that are randomly selected to 
prevent detection of a virtuality of the parameters". The examiner has found the reference 
Hutchison (U.S. Pat No. 6,457,022) which discusses random selection. Hence, simple random 
selection would not be patentable over the prior art. However, the examiner finds no support for 

25 the idea of randomly selecting parameters, such as file structure and name parameters, in order 
to prevent detection of a virtuality of the parameters. This limitation defines the invention such 
that the parameters designated for opened share mode are not intentionally designated. Rather 
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the parameters are randomly selected, and the random selection is done for the specific cause of 
preventing detection of a virtuality of the parameters. 

Second, the examiner finds no support for the limitation, "wherein the security process 
includes temporarily logging off the network, recording in a record information on any attempt to 
5 modify the computer including time and source information, logging the computer back on the 
network in a mode other than the actual opened share mode, transmitting the information to a 
third party, determining whether a trend is found indicative of a coordinated attack, and sending 
an alert and logging a culpable computer off the network based on the determination". The 
examiner notes that this claim limitation is repeated verbatim in independent claims 1,24, and 50, 

10 and the other independent claims of 51 and 52 incorporate substantially the same concept though 
the presentation is slightly different. The examiner finds no support for the combination of these 
steps in order to accomplish the task of identifying a coordinated attack and logging a culpable 
computer off the network based on the analysis. Further, the examiner does not believe the 
limitations, if found in individual references, would be an obvious combination to one of ordinary 

15 skill in the art at the time the invention was filed. The examiner believes the plurality of steps 
function together as part of a unique, cohesive whole that is not found in the prior art. 

Conclusion 

Any inquiry concerning this communication or earlier communications from the examiner 
20 should be directed to Kevin Schubert whose telephone number is (571) 272-4239. The examiner 
can normally be reached on M-F 7:30-6:00. 

If attempts to reach the examiner by telephone are unsuccessful, the examiner's 
supervisor, Emmanuel Moise can be reached on (571) 272-3868. The fax phone number for the 
organization where this application or proceeding is assigned is 571-273-8300. 
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Information regarding the status of an application may be obtained from the Patent 
Application Information Retrieval (PAIR) system. Status information for published applications 
may be obtained from either Private PAIR or Public PAIR. Status information for unpublished 
applications is available through Private PAIR only. For more information about the PAIR system, 
5 see http://pair-direct.uspto.gov. Should you have questions on access to the Private PAIR 
system, contact the Electronic Business Center (EBC) at 866-217-9197 (toll-free). 



KS 




10 



